Update on some maintainers / contributors.

Update on some maintainers / contributors.

[Patrick Williams]

[-- Attachment #1: Type: text/plain, Size: 2592 bytes --]

Hello,

This is not a great situation for Open Source as a whole; involving
legal issues and international politics.  Since there has been some
public activity on other Open Source projects, especially the kernel,
it seems like we should be more forward about what is going on.

In early 2022, some of our contributors associated with a specific
company lost access to GitHub.  As a result of this they were unable to
access Gerrit.  Since that time, access has not been restored and they
continue to not be able to contribute to the project or provide feedback
as maintainers on sub-repositories (which some of them were).

I assume the reason those developers had their GitHub accounts
suspended was due to their company's appearance on a US government
sanctions list[1].  Recently, the Linux Kernel has removed a number of
maintainers for seemingly similar reasons.  A good article on the
situation can be found on Phoronix[2].

I have not seen any official/public policy from the Linux Foundation on
this situation, but it appears that high ranking members of the kernel
community decided to act based on some non-public guidance they were given.

The way we are handling the situation is as follows:

   - We use GitHub for authentication to Gerrit and have no plans to
     change from this.  Anyone interacting with the code there will
     need to have GitHub access.  Anyone who has been suspended /
     blocked by GitHub will not be able to interact with the codebase
     by either contributions or reviews.

   - We are not accepting new CCLAs from entities on the sanctions list
     or accepting ICLAs from individuals associated with these
     entities.

   - Maintainers who have lost access to Gerrit are being removed from
     OWNERS files to provide clarity to contributors.  I believe this
     affects one full repository and one meta layer.  I am assigning
     myself as the OWNER of the affected repository to ensure continuity
     of reviews but would greatly appreciate if someone else has an
     interest to take it over.  If the situation changes and the
     previous maintainers are able to resume participation, we can
     restore owner status to them.

   - No change is being implemented to the mailing list or Discord.

I do not have any advice for individual contributors on the project.  If
you have concerns, you may want to seek guidance within your company.

[1]: https://ofac.treasury.gov/faqs/topic/1631
[2]: https://www.phoronix.com/news/Linux-Compliance-Requirements

-- 
Patrick Williams

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Update on some maintainers / contributors.

[Paul Fertser]

Hello Patrick,

On Thu, Oct 31, 2024 at 12:31:33AM -0400, Patrick Williams wrote:
> it seems like we should be more forward about what is going on.

Great to hear you think that, and thanks a lot for approaching this in
a more humane way.

>    - We are not accepting new CCLAs from entities on the sanctions list
>      or accepting ICLAs from individuals associated with these
>      entities.

Please consider trying to do better than the "high ranking members of
the kernel community" mentioned earlier and adding specific, explicit
rules regarding this issue to the project documentation.

In particular, it would be really important to clarify 

1. Which sanctions list it is exactly; for Linux they say they are
going to follow just the SDN and not the whole OFAC so even despite
e.g. Huawei is sanctioned they are still allowed to not only
contribute code but also maintain parts of the project.

2. How association of an individual with an entity is established. The
kernel people were mentioning some documents that a developer might
provide to prove they're not associated but it's hard to imagine what
kind of document that might even be.

-- 
Be free, use free (http://www.gnu.org/philosophy/free-sw.html) software!
mailto:fercerpav@gmail.com

Re: Update on some maintainers / contributors.

[Patrick Williams]

[-- Attachment #1: Type: text/plain, Size: 3508 bytes --]

On Thu, Oct 31, 2024 at 01:05:12PM +0300, Paul Fertser wrote:
> Hello Patrick,

Hi Paul,

For clarity I've tried to be very purposeful in my use of "I" and "we"
in both this email and the previous one.

    "I" - me personally
    "We" - the project as a whole, speaking as a member of both the
           TSC and TOF.

> 
> On Thu, Oct 31, 2024 at 12:31:33AM -0400, Patrick Williams wrote:
> > it seems like we should be more forward about what is going on.
> 
> Great to hear you think that, and thanks a lot for approaching this in
> a more humane way.
> 
> >    - We are not accepting new CCLAs from entities on the sanctions list
> >      or accepting ICLAs from individuals associated with these
> >      entities.
> 
> Please consider trying to do better than the "high ranking members of
> the kernel community" mentioned earlier and adding specific, explicit
> rules regarding this issue to the project documentation.

OpenBMC is a Linux Foundation project and we generally look to them to
provide policy for this sort of situation.  Thus far I have not seen
anything formal from them.

The usual "I am not a lawyer" disclaimer...

It is my understanding that, independent of any Linux Foundation policy,
a very large portion of our developers are bound by the US sanctions (even
if you have never even entered the US).  If you are covered by a CCLA,
you are also contributing to the project as an agent of your employer
and also have to comply with your employer's policy on the matter.  Based
on informal conversations I have had, for people that have had explicit
conversations with legal representation, there has been an array of 
"what to do" advice.

The best we can do at this time is what I have already written.

[[
    Re "very large portion": It would not surprise me if 100% of active
    contributors are subject to the SDN.  If you go back 2 years it was
    still probably over 90%.
]]

> In particular, it would be really important to clarify 
> 
> 1. Which sanctions list it is exactly; for Linux they say they are
> going to follow just the SDN and not the whole OFAC so even despite
> e.g. Huawei is sanctioned they are still allowed to not only
> contribute code but also maintain parts of the project.

Yes, the SDN is the primary list of concern right now.  LF has
previously made a statement about Huawei.

https://www.linuxfoundation.org/blog/blog/linux-foundation-statement-on-huawei-entity-list-ruling

Ultimately, there are current 21 different sanctions programs, with
different policies and lists, that many of us are required to follow
even if we are unaware.

https://www.state.gov/economic-sanctions-programs/

[[ 
   I realize I'm taking a very US-centric view here; other countries
   have their own sanctions programs.  It is quite likely that I am
   also required to personally comply with rules from the EU that I'm
   not even aware of.
]]

> 2. How association of an individual with an entity is established. The
> kernel people were mentioning some documents that a developer might
> provide to prove they're not associated but it's hard to imagine what
> kind of document that might even be.

For individuals covered by a CCLA, it is relatively easy; for those
that send an ICLA it is not.  Until there is a formal policy available
to us, I don't really want to say any more because I don't want what I
write here to be construed as the policy.


-- 
Patrick Williams

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Update on some maintainers / contributors.

[Patrick Williams]

[-- Attachment #1: Type: text/plain, Size: 2974 bytes --]

The Linux Foundation made a clarifying post on this situation[1].

[1]: https://www.linuxfoundation.org/blog/navigating-global-regulations-and-open-source-us-ofac-sanctions

On Thu, Oct 31, 2024 at 12:31:33AM -0400, Patrick Williams wrote:
> Hello,
> 
> This is not a great situation for Open Source as a whole; involving
> legal issues and international politics.  Since there has been some
> public activity on other Open Source projects, especially the kernel,
> it seems like we should be more forward about what is going on.
> 
> In early 2022, some of our contributors associated with a specific
> company lost access to GitHub.  As a result of this they were unable to
> access Gerrit.  Since that time, access has not been restored and they
> continue to not be able to contribute to the project or provide feedback
> as maintainers on sub-repositories (which some of them were).
> 
> I assume the reason those developers had their GitHub accounts
> suspended was due to their company's appearance on a US government
> sanctions list[1].  Recently, the Linux Kernel has removed a number of
> maintainers for seemingly similar reasons.  A good article on the
> situation can be found on Phoronix[2].
> 
> I have not seen any official/public policy from the Linux Foundation on
> this situation, but it appears that high ranking members of the kernel
> community decided to act based on some non-public guidance they were given.
> 
> The way we are handling the situation is as follows:
> 
>    - We use GitHub for authentication to Gerrit and have no plans to
>      change from this.  Anyone interacting with the code there will
>      need to have GitHub access.  Anyone who has been suspended /
>      blocked by GitHub will not be able to interact with the codebase
>      by either contributions or reviews.
> 
>    - We are not accepting new CCLAs from entities on the sanctions list
>      or accepting ICLAs from individuals associated with these
>      entities.
> 
>    - Maintainers who have lost access to Gerrit are being removed from
>      OWNERS files to provide clarity to contributors.  I believe this
>      affects one full repository and one meta layer.  I am assigning
>      myself as the OWNER of the affected repository to ensure continuity
>      of reviews but would greatly appreciate if someone else has an
>      interest to take it over.  If the situation changes and the
>      previous maintainers are able to resume participation, we can
>      restore owner status to them.
> 
>    - No change is being implemented to the mailing list or Discord.
> 
> I do not have any advice for individual contributors on the project.  If
> you have concerns, you may want to seek guidance within your company.
> 
> [1]: https://ofac.treasury.gov/faqs/topic/1631
> [2]: https://www.phoronix.com/news/Linux-Compliance-Requirements
> 
> -- 
> Patrick Williams



-- 
Patrick Williams

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Update on some maintainers / contributors.

[Paul Fertser]

Hello Patrick,

On Thu, Apr 03, 2025 at 11:04:40AM -0400, Patrick Williams wrote:
> The Linux Foundation made a clarifying post on this situation[1].
> 
> [1]: https://www.linuxfoundation.org/blog/navigating-global-regulations-and-open-source-us-ofac-sanctions

Kudos to the Linux Foundation lawyers for this prompt,
well-thought-out and, most importantly, directly applicable advice.

For those who get a little bit sea-sick reading legalese I took the
liberty of extracting what I found to be the most relevant to the
OpenBMC community:

"
developers[...] need to be cautious about who you interact with and
where your contributions come from.
[...]
Specially Designated Nationals and Blocked Persons ("SDN") List. OFAC
updates this list regularly, adding or removing names as global
situations change.
[...]
Key Points for Developers
[...]
you should consult your legal counsel immediately
[...]
1. OFAC's SDN "List" Is Not Enough
[...]
First there's the 50% percent rule if an entity is 50% or more owned
directly or indirectly by one or more SDNs. That requires identifying
who owns an entity, and (in many cases) who also owns that entity, up
until all owners are identified. Second, some sanctions apply to
entire countries (e.g. Iran), regions (e.g., the Crimea region of
Ukraine), or governments (e.g., the Government of
Venezuela)[...]. Additionally, the SDN List is constantly
changing. Just because an individual or entity is not on the SDN List
today does not mean they, or their owner, will not be added
tomorrow.
[...]
3. Avoid Two-Way Engagement
[...] help improve a patch or modify code would likely cross the line.
[...]
5. Avoid Indirect Contributions
[...]
seek legal advice early to avoid compliance issues.[...] By staying
aware and proactive, you can contribute to open source confidently

"

HTH